Wazuh - Large Number of Web errors from an IP

Severity: low
Time window: 1d
Group by: HostName, SourceIP
Author: Jordan Ross
Source: github.com/Azure/Azure-Sentinel

'Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://documentation.wazuh.com/current/cloud-security/azure/index.html'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: 2790795b-7dba-483e-853f-44aa0bc9c985
name: Wazuh - Large Number of Web errors from an IP
description: |
  'Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://documentation.wazuh.com/current/cloud-security/azure/index.html'
severity: Low
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  CommonSecurityLog
  | where DeviceProduct =~ "Wazuh"
  | where Activity has "Web server 400 error code."
  | where Message has "403"
  | extend HostName=substring(split(DeviceCustomString1,")")[0],1)
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumberOfErrors = dcount(SourceIP) by HostName, SourceIP
  | where NumberOfErrors > 400
  | sort by NumberOfErrors desc
  | extend timestamp = StartTime
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
version: 1.0.5
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Jordan Ross
    support:
        tier: Community
    categories:
        domains: [ "Security - Others", "Networking" ]

Stages and Predicates

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where DeviceProduct =~ "Wazuh"

Stage 3: `where`

| where Activity has "Web server 400 error code."

Stage 4: `where`

| where Message has "403"

Stage 5: `extend`

| extend HostName=substring(split(DeviceCustomString1,")")[0],1)

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumberOfErrors = dcount(SourceIP) by HostName, SourceIP

Stage 7: `where`

| where NumberOfErrors > 400

Stage 8: `sort`

| sort by NumberOfErrors desc

Stage 9: `extend`

| extend timestamp = StartTime

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Activity`	match	`Web server 400 error code.` transforms: `term`	`field:"Activity" kind:match value:"Web server 400 error code."`
`DeviceProduct`	eq	`Wazuh`	`field:"DeviceProduct" kind:eq value:"Wazuh"`
`Message`	match	`403` transforms: `term`	`field:"Message" kind:match value:"403"`
`NumberOfErrors`	gt	`400`	`field:"NumberOfErrors" kind:gt value:"400"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`HostName`	`summarize`
`NumberOfErrors`	`summarize`
`SourceIP`	`summarize`
`StartTime`	`summarize`
`timestamp`	`extend`

Wazuh - Large Number of Web errors from an IP

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: summarize

Stage 7: where

Stage 8: sort

Stage 9: extend